Employee Offboarding Checklist

Free employee offboarding checklist for Microsoft 365

Here is the short version: on the last day, block sign-in, revoke sessions, reset the password, and read inbox rules before you touch the mailbox. This employee offboarding checklist tracks those steps in your browser. It does not log into Entra ID.

Accounts left on after someone leaves are a common incident path. CIS puts this under Access Control Management. Microsoft’s own series is Remove a former employee. Use this page as the ticket, then do the work in the admin centers.

Pair it with the cybersecurity risk assessment if you want the wider score. Offboarding is one question there. This page is the runbook.

Same day is not “disable the user”

Blocking the account stops new tokens. Existing access tokens can last about an hour. Session cookies in desktop Outlook or a phone can last longer if you never revoke. Microsoft documents the order in Revoke user access in Microsoft Entra ID: disable the account, revoke sessions, disable registered devices.

On a hybrid tenant, disable and reset the password in on-premises Active Directory first, or the next sync will turn the cloud account back on. Reset the password twice if you worry about pass-the-hash. Then revoke Entra sessions.

Inbox rules are the item firms skip. A hidden forward to a personal Gmail account is how a “departed” mailbox keeps leaking. Check rules, forwarding, mailbox delegates, and app passwords on day one. Then revoke the Entra app consents they clicked (“Login with Microsoft” on a random PDF tool). Those grants survive a password reset.

What to keep, what to delete

Do not delete the account on the last day unless counsel said to. You usually need:

1. The mailbox, as a shared mailbox or on hold
2. OneDrive files, transferred to a manager
3. Teams ownership, so a client channel does not die
4. A forwarding address for a few weeks

Microsoft keeps content for a short window after you delete a user. Do not bet the matter file on that window. Convert, transfer, then reclaim the license. The checklist puts license reclaim in the 48-hour group on purpose.

Legal hold belongs before anyone “cleans up” the mailbox. If HR even hinted at a dispute, stop and ask counsel. IT should not be the one who emptied the evidence.

Devices, vaults, and the stuff that is not Entra

Intune can wipe a managed laptop. An unmanaged home PC that had Outlook installed cannot be wiped from the cloud. Collect the hardware. Retire the object in MDM so it cannot keep pulling mail.

Password vaults are the other silent miss. If they were in 1Password, Bitwarden, or a shared LastPass folder, remove them before you send the “thanks for everything” email. Shared items they could export are now a rotation job. Use the password generator when you replace those secrets.

VPN profiles, Wi-Fi PSKs written on a sticky note, and the alarm code for the suite are not in Entra. Write them on the ticket. Managed help desk is the group that should own this list so HR is not pinging three vendors.

Privileged and finance leavers

A standard associate is a same-day identity job. A bookkeeper is also a payments job. A Global Admin is an incident-shaped job.

For finance: remove bank, payroll, and bill-pay the same day. Tell AP that any “updated wiring instructions” from that person’s address are hostile until proven otherwise. That is the same habit as the phishing email checker.

For IT: remove directory roles, rotate the secrets they could see, and transfer DNS, registrar, Azure, AWS, and GitHub. A personal Microsoft account that was still a guest on the tenant counts. So does the Authenticator entry for the break-glass account.

NIST SP 800-53 treats account disable and revocation as Access Control (AC-2), not as an HR courtesy. Offboarding is how you stop a former admin from remaining an admin.

Worked example (18-person Valley law firm)

An associate leaves Friday. HR emails IT at 3:40 p.m.

Same day: block Entra, revoke sessions, reset password, dump inbox rules, pull them from the litigation security group and the billing shared mailbox, disable VPN, remove them from the vault, collect the laptop. Leave the mailbox.

Monday: convert to shared, give the practice chair access, move OneDrive, remove Clio and Adobe, reclaim the license after the chair confirms the files are there.

If they had been the only Global Admin, Friday also includes promoting a second admin and rotating the tenant’s shared secrets. Do not discover that on Monday.

Guests, OAuth, and the mailbox that still talks

Enterprise applications in Entra show which apps they consented to. A departed user who clicked “Login with Microsoft” on a random PDF tool can leave that grant sitting there. Review their sign-in log and revoke those grants when you revoke sessions.

Guest accounts are the cousin of this problem. If they invited a personal Gmail into a client Teams, remove the guest or transfer the invite. Shared mailboxes they “Send As” still accept their old Outlook profile until you strip the permission.

Personal phones with the Microsoft Authenticator app still hold MFA methods until you delete those methods. Blocking sign-in is not the same as wiping Authenticator.

What this checklist is not

It is not a Microsoft Graph script. It will not disable the user for you. It will not find every SaaS app they signed into with “Login with Microsoft” unless you look at Entra enterprise applications. It is not legal advice about holds.

Score starts at 0% with every box open. That is the honest first result. A 100% on this page means you checked boxes, not that the tenant is clean.

The offices that get hurt are the ones that delete the account on Friday, skip the forward rule, and leave QuickBooks open until Monday.

If you want help desk to run joiners and leavers as a ticket, not a 3:40 p.m. scramble, contact Secure Techies.